feat(ci): Add Forgejo Actions CI and schema integration tests #2
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/ci-and-schema-tests"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
CI runs Go unit tests and a separate schema integration job that
spins up a throwaway Postgres 17 service, applies the three schema
migrations, and exercises the data model end-to-end.
Integration tests in internal/dbtest cover the full operation lifecycle
(plan → decision → operation → execution), the single-use execution
constraint, role enforcement across all four roles, the effective_trust
view's supersession chain, and the proportional_approval check constraints.
Includes RunnerPool manifest to provision a dedicated runner for the
repository via the existing custom runner management controller.
Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com
Automated review by pr-reviewer v0.15.0 | Safety Check | anthropic | tracking id
r-dbef47-cdecf6This is an AI-generated review and may contain mistakes.
Status: ✅ Completed
✅ Verdict: LGTM — No security issues or obvious bugs found - this is a standard CI setup with integration tests.
Complexity: moderate
Safety Check Review
Summary
This PR adds CI/CD configuration and comprehensive integration tests for a database schema. No security vulnerabilities or obvious bugs detected.
Key Changes Reviewed
Automated Alerts Addressed
POSTGRES_PASSWORD: testis a hardcoded test password for the ephemeral CI database service - this is standard practice and not a security concernSecurity Assessment
The changes appear well-structured and follow Go/CI best practices.
Add Forgejo Actions CI and schema integration teststo feat(ci): Add Forgejo Actions CI and schema integration tests57eb45bbd8a0e81cb42bAutomated review by pr-reviewer v0.15.0 | Safety Check | anthropic | tracking id
r-dbeffc-4ecc94This is an AI-generated review and may contain mistakes.
Status: ✅ Completed
✅ Verdict: LGTM — The CI workflow and integration tests look reasonable with no obvious security issues or bugs.
Complexity: moderate
Safety Check Review
Overview
This PR adds CI workflow and database integration tests. The automated flags about credentials and high entropy content are expected for this type of change.
Key Observations
CI Configuration (.forgejo/workflows/test.yaml)
POSTGRES_PASSWORD: test) - appropriate for CIDependencies (go.mod/go.sum)
jackc/pgx/v5- standard choiceIntegration Tests (internal/dbtest/dbtest_test.go)
No Security Issues Found
The automated observations are false positives expected for this type of change.
Automated review by pr-reviewer v0.15.0 | Safety Check | anthropic | tracking id
r-dbf138-ad3912This is an AI-generated review and may contain mistakes.
Status: ✅ Completed
✅ Verdict: LGTM — No obvious bugs, security issues, or breaking changes detected - just adding CI and integration tests for a database schema.
Complexity: moderate
Safety Check Review
Summary
Adding Forgejo Actions CI workflow and comprehensive database integration tests. No alarming issues found.
Key Changes
github.com/jackc/pgx/v5)Automated Observations Addressed
FORGEJO_TOKENis properly used as a GitHub Actions secret reference (${{ secrets.FORGEJO_TOKEN }}), not a hardcoded valueNotes
Everything looks standard for a CI setup with database integration testing.
Automated review by pr-reviewer v0.15.0 | Safety Check | anthropic | tracking id
r-dbf3c5-e7b466This is an AI-generated review and may contain mistakes.
Status: ✅ Completed
⚠️ Verdict: Flag — The workflow file exposes a sensitive authentication token (FORGEJO_TOKEN) in plaintext during repository cloning operations.
Complexity: moderate
Security Issue: Token Exposure in CI Workflow
Critical Issue
The CI workflow
.forgejo/workflows/test.yamlcontains a security vulnerability where theFORGEJO_TOKENis exposed in the git clone command:This token will be visible in:
Recommendation
Use a more secure checkout method or ensure the token is properly masked in all output contexts. Consider using the standard checkout action if available, or redirect stdout/stderr when running the git clone command.
Other Observations
The rest of the changes appear reasonable: